CVE ID : CVE-2026-23005<\/p>\n
Published : Jan. 25, 2026, 3:15 p.m. | 1\u00a0hour, 46\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1<\/p>\n
When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in
\nresponse to a guest WRMSR, clear XFD-disabled features in the saved (or to
\nbe restored) XSTATE_BV to ensure KVM doesn’t attempt to load state for
\nfeatures that are disabled via the guest’s XFD. Because the kernel
\nexecutes XRSTOR with the guest’s XFD, saving XSTATE_BV[i]=1 with XFD[i]=1
\nwill cause XRSTOR to #NM and panic the kernel.<\/p>\n
E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:<\/p>\n
————[ cut here ]————
\n WARNING: arch\/x86\/kernel\/traps.c:1524 at exc_device_not_available+0x101\/0x110, CPU#29: amx_test\/848
\n Modules linked in: kvm_intel kvm irqbypass
\n CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02\/06\/2015
\n RIP: 0010:exc_device_not_available+0x101\/0x110
\n Call Trace:<\/p>\n
asm_exc_device_not_available+0x1a\/0x20
\n RIP: 0010:restore_fpregs_from_fpstate+0x36\/0x90
\n switch_fpu_return+0x4a\/0xb0
\n kvm_arch_vcpu_ioctl_run+0x1245\/0x1e40 [kvm]\n kvm_vcpu_ioctl+0x2c3\/0x8f0 [kvm]\n __x64_sys_ioctl+0x8f\/0xd0
\n do_syscall_64+0x62\/0x940
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53<\/p>\n
—[ end trace 0000000000000000 ]—<\/p>\n
This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,
\nand a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler’s
\ncall to fpu_update_guest_xfd().<\/p>\n
and if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:<\/p>\n
————[ cut here ]————
\n WARNING: arch\/x86\/kernel\/traps.c:1524 at exc_device_not_available+0x101\/0x110, CPU#14: amx_test\/867
\n Modules linked in: kvm_intel kvm irqbypass
\n CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02\/06\/2015
\n RIP: 0010:exc_device_not_available+0x101\/0x110
\n Call Trace:<\/p>\n
asm_exc_device_not_available+0x1a\/0x20
\n RIP: 0010:restore_fpregs_from_fpstate+0x36\/0x90
\n fpu_swap_kvm_fpstate+0x6b\/0x120
\n kvm_load_guest_fpu+0x30\/0x80 [kvm]\n kvm_arch_vcpu_ioctl_run+0x85\/0x1e40 [kvm]\n kvm_vcpu_ioctl+0x2c3\/0x8f0 [kvm]\n __x64_sys_ioctl+0x8f\/0xd0
\n do_syscall_64+0x62\/0x940
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53<\/p>\n
—[ end trace 0000000000000000 ]—<\/p>\n
The new behavior is consistent with the AMX architecture. Per Intel’s SDM,
\nXSAVE saves XSTATE_BV as ‘0’ for components that are disabled via XFD
\n(and non-compacted XSAVE saves the initial configuration of the state
\ncomponent):<\/p>\n
If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,
\n the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;
\n instead, it operates as if XINUSE[i] = 0 (and the state component was
\n in its initial state): it saves bit i of XSTATE_BV field of the XSAVE
\n header as 0; in addition, XSAVE saves the initial configuration of the
\n state component (the other instructions do not save state component i).<\/p>\n
Alternatively, KVM could always do XRSTOR with XFD=0, e.g. by using
\na constant XFD based on the set of enabled features when XSAVEing for
\na struct fpu_guest. However, having XSTATE_BV[i]=1 for XFD-disabled
\nfeatures can only happen in the above interrupt case, or in similar
\nscenarios involving preemption on preemptible kernels, because
\nfpu_swap_kvm_fpstate()’s call to save_fpregs_to_fpstate() saves the
\noutgoing FPU state with the current XFD; and that is (on all but the
\nfirst WRMSR to XFD) the guest XFD.<\/p>\n
Therefore, XFD can only go out of sync with XSTATE_BV in the above
\ninterrupt case, or in similar scenarios involving preemption on
\npreemptible kernels, and it we can consider it (de facto) part of KVM
\nABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.<\/p>\n[Move clea
\n—truncated—<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2026-23005 Published : Jan. 25, 2026, 3:15 p.m. | 1\u00a0hour, 46\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: x86\/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-75815","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/75815","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=75815"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/75815\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=75815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=75815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=75815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}